mDNSMacOSX/pfkey.c

   1 /*
   2  * Copyright (c) 2003-2007 Apple Computer, Inc. All rights reserved.
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16 /*      $FreeBSD: src/lib/libipsec/pfkey.c,v 1.1.2.2 2001/07/03 11:01:14 ume Exp $      */
  17 /*      $KAME: pfkey.c,v 1.39 2001/03/05 18:22:17 thorpej Exp $ */
  18
  19 /*
  20  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
  21  * All rights reserved.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the above copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. Neither the name of the project nor the names of its contributors
  32  *    may be used to endorse or promote products derived from this software
  33  *    without specific prior written permission.
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  36  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  38  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  39  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  40  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  41  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  42  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  43  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  44  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  45  * SUCH DAMAGE.
  46  */
  47
  48 #include <sys/types.h>
  49 #include <sys/param.h>
  50 #include <sys/socket.h>
  51 #include <net/pfkeyv2.h>
  52 #include <netinet/in.h>
  53 #include <netinet6/ipsec.h>
  54
  55 #include <stdlib.h>
  56 #include <unistd.h>
  57 #include <string.h>
  58 #include <errno.h>
  59 #include <stdio.h>
  60
  61 #include "ipsec_strerror.h"
  62 #include "libpfkey.h"
  63
  64 #define CALLOC(size, cast) (cast)calloc(1, (size))
  65
  66 static int findsupportedmap __P((int));
  67 static int setsupportedmap __P((struct sadb_supported *));
  68 static struct sadb_alg *findsupportedalg __P((u_int, u_int));
  69 static int pfkey_send_x1 __P((int, u_int, u_int, u_int, struct sockaddr *,
  70         struct sockaddr *, u_int32_t, u_int32_t, u_int, caddr_t,
  71         u_int, u_int, u_int, u_int, u_int, u_int32_t, u_int32_t,
  72         u_int32_t, u_int32_t, u_int32_t));
  73 static int pfkey_send_x2 __P((int, u_int, u_int, u_int,
  74         struct sockaddr *, struct sockaddr *, u_int32_t));
  75 static int pfkey_send_x3 __P((int, u_int, u_int));
  76 static int pfkey_send_x4 __P((int, u_int, struct sockaddr *, u_int,
  77         struct sockaddr *, u_int, u_int, u_int64_t, u_int64_t,
  78         char *, int, u_int32_t));
  79 static int pfkey_send_x5 __P((int, u_int, u_int32_t));
  80
  81 static caddr_t pfkey_setsadbmsg __P((caddr_t, caddr_t, u_int, u_int,
  82         u_int, u_int32_t, pid_t));
  83 static caddr_t pfkey_setsadbsa __P((caddr_t, caddr_t, u_int32_t, u_int,
  84         u_int, u_int, u_int32_t));
  85 static caddr_t pfkey_setsadbaddr __P((caddr_t, caddr_t, u_int,
  86         struct sockaddr *, u_int, u_int));
  87 static caddr_t pfkey_setsadbkey __P((caddr_t, caddr_t, u_int, caddr_t, u_int));
  88 static caddr_t pfkey_setsadblifetime __P((caddr_t, caddr_t, u_int, u_int32_t,
  89         u_int32_t, u_int32_t, u_int32_t));
  90 static caddr_t pfkey_setsadbxsa2 __P((caddr_t, caddr_t, u_int32_t, u_int32_t));
  91
  92 /*
  93  * make and search supported algorithm structure.
  94  */
  95 static struct sadb_supported *ipsec_supported[] = { NULL, NULL, NULL, };
  96
  97 static int supported_map[] = {
  98         SADB_SATYPE_AH,
  99         SADB_SATYPE_ESP,
 100         SADB_X_SATYPE_IPCOMP,
 101 };
 102
 103 static int
 104 findsupportedmap(satype)
 105         int satype;
 106 {
 107         int i;
 108
 109         for (i = 0; (unsigned int)i < sizeof(supported_map)/sizeof(supported_map[0]); i++)
 110                 if (supported_map[i] == satype)
 111                         return i;
 112         return -1;
 113 }
 114
 115 static struct sadb_alg *
 116 findsupportedalg(satype, alg_id)
 117         u_int satype, alg_id;
 118 {
 119         int algno;
 120         int tlen;
 121         caddr_t p;
 122
 123         /* validity check */
 124         algno = findsupportedmap(satype);
 125         if (algno == -1) {
 126                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 127                 return NULL;
 128         }
 129         if (ipsec_supported[algno] == NULL) {
 130                 __ipsec_errcode = EIPSEC_DO_GET_SUPP_LIST;
 131                 return NULL;
 132         }
 133
 134         tlen = ipsec_supported[algno]->sadb_supported_len
 135                 - sizeof(struct sadb_supported);
 136         p = (caddr_t)(ipsec_supported[algno] + 1);
 137         while (tlen > 0) {
 138                 if ((unsigned int)tlen < sizeof(struct sadb_alg)) {
 139                         /* invalid format */
 140                         break;
 141                 }
 142                 if (((struct sadb_alg *)p)->sadb_alg_id == alg_id)
 143                         return (struct sadb_alg *)p;
 144
 145                 tlen -= sizeof(struct sadb_alg);
 146                 p += sizeof(struct sadb_alg);
 147         }
 148
 149         __ipsec_errcode = EIPSEC_NOT_SUPPORTED;
 150         return NULL;
 151 }
 152
 153 static int
 154 setsupportedmap(sup)
 155         struct sadb_supported *sup;
 156 {
 157         struct sadb_supported **ipsup;
 158
 159         switch (sup->sadb_supported_exttype) {
 160         case SADB_EXT_SUPPORTED_AUTH:
 161                 ipsup = &ipsec_supported[findsupportedmap(SADB_SATYPE_AH)];
 162                 break;
 163         case SADB_EXT_SUPPORTED_ENCRYPT:
 164                 ipsup = &ipsec_supported[findsupportedmap(SADB_SATYPE_ESP)];
 165                 break;
 166         default:
 167                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
 168                 return -1;
 169         }
 170
 171         if (*ipsup)
 172                 free(*ipsup);
 173
 174         *ipsup = malloc(sup->sadb_supported_len);
 175         if (!*ipsup) {
 176                 __ipsec_set_strerror(strerror(errno));
 177                 return -1;
 178         }
 179         memcpy(*ipsup, sup, sup->sadb_supported_len);
 180
 181         return 0;
 182 }
 183
 184 /*
 185  * check key length against algorithm specified.
 186  * This function is called with SADB_EXT_SUPPORTED_{AUTH,ENCRYPT} as the
 187  * augument, and only calls to ipsec_check_keylen2();
 188  * keylen is the unit of bit.
 189  * OUT:
 190  *      -1: invalid.
 191  *       0: valid.
 192  */
 193 int
 194 ipsec_check_keylen(supported, alg_id, keylen)
 195         u_int supported;
 196         u_int alg_id;
 197         u_int keylen;
 198 {
 199         int satype;
 200
 201         /* validity check */
 202         switch (supported) {
 203         case SADB_EXT_SUPPORTED_AUTH:
 204                 satype = SADB_SATYPE_AH;
 205                 break;
 206         case SADB_EXT_SUPPORTED_ENCRYPT:
 207                 satype = SADB_SATYPE_ESP;
 208                 break;
 209         default:
 210                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 211                 return -1;
 212         }
 213
 214         return ipsec_check_keylen2(satype, alg_id, keylen);
 215 }
 216
 217 /*
 218  * check key length against algorithm specified.
 219  * satype is one of satype defined at pfkeyv2.h.
 220  * keylen is the unit of bit.
 221  * OUT:
 222  *      -1: invalid.
 223  *       0: valid.
 224  */
 225 int
 226 ipsec_check_keylen2(satype, alg_id, keylen)
 227         u_int satype;
 228         u_int alg_id;
 229         u_int keylen;
 230 {
 231         struct sadb_alg *alg;
 232
 233         alg = findsupportedalg(satype, alg_id);
 234         if (!alg)
 235                 return -1;
 236
 237         if (keylen < alg->sadb_alg_minbits || keylen > alg->sadb_alg_maxbits) {
 238                 __ipsec_errcode = EIPSEC_INVAL_KEYLEN;
 239                 return -1;
 240         }
 241
 242         __ipsec_errcode = EIPSEC_NO_ERROR;
 243         return 0;
 244 }
 245
 246 /*
 247  * get max/min key length against algorithm specified.
 248  * satype is one of satype defined at pfkeyv2.h.
 249  * keylen is the unit of bit.
 250  * OUT:
 251  *      -1: invalid.
 252  *       0: valid.
 253  */
 254 int
 255 ipsec_get_keylen(supported, alg_id, alg0)
 256         u_int supported, alg_id;
 257         struct sadb_alg *alg0;
 258 {
 259         struct sadb_alg *alg;
 260         u_int satype;
 261
 262         /* validity check */
 263         if (!alg0) {
 264                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 265                 return -1;
 266         }
 267
 268         switch (supported) {
 269         case SADB_EXT_SUPPORTED_AUTH:
 270                 satype = SADB_SATYPE_AH;
 271                 break;
 272         case SADB_EXT_SUPPORTED_ENCRYPT:
 273                 satype = SADB_SATYPE_ESP;
 274                 break;
 275         default:
 276                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 277                 return -1;
 278         }
 279
 280         alg = findsupportedalg(satype, alg_id);
 281         if (!alg)
 282                 return -1;
 283
 284         memcpy(alg0, alg, sizeof(*alg0));
 285
 286         __ipsec_errcode = EIPSEC_NO_ERROR;
 287         return 0;
 288 }
 289
 290 /*
 291  * set the rate for SOFT lifetime against HARD one.
 292  * If rate is more than 100 or equal to zero, then set to 100.
 293  */
 294 static u_int soft_lifetime_allocations_rate = PFKEY_SOFT_LIFETIME_RATE;
 295 static u_int soft_lifetime_bytes_rate = PFKEY_SOFT_LIFETIME_RATE;
 296 static u_int soft_lifetime_addtime_rate = PFKEY_SOFT_LIFETIME_RATE;
 297 static u_int soft_lifetime_usetime_rate = PFKEY_SOFT_LIFETIME_RATE;
 298
 299 u_int
 300 pfkey_set_softrate(type, rate)
 301         u_int type, rate;
 302 {
 303         __ipsec_errcode = EIPSEC_NO_ERROR;
 304
 305         if (rate > 100 || rate == 0)
 306                 rate = 100;
 307
 308         switch (type) {
 309         case SADB_X_LIFETIME_ALLOCATIONS:
 310                 soft_lifetime_allocations_rate = rate;
 311                 return 0;
 312         case SADB_X_LIFETIME_BYTES:
 313                 soft_lifetime_bytes_rate = rate;
 314                 return 0;
 315         case SADB_X_LIFETIME_ADDTIME:
 316                 soft_lifetime_addtime_rate = rate;
 317                 return 0;
 318         case SADB_X_LIFETIME_USETIME:
 319                 soft_lifetime_usetime_rate = rate;
 320                 return 0;
 321         }
 322
 323         __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 324         return 1;
 325 }
 326
 327 /*
 328  * get current rate for SOFT lifetime against HARD one.
 329  * ATTENTION: ~0 is returned if invalid type was passed.
 330  */
 331 u_int
 332 pfkey_get_softrate(type)
 333         u_int type;
 334 {
 335         switch (type) {
 336         case SADB_X_LIFETIME_ALLOCATIONS:
 337                 return soft_lifetime_allocations_rate;
 338         case SADB_X_LIFETIME_BYTES:
 339                 return soft_lifetime_bytes_rate;
 340         case SADB_X_LIFETIME_ADDTIME:
 341                 return soft_lifetime_addtime_rate;
 342         case SADB_X_LIFETIME_USETIME:
 343                 return soft_lifetime_usetime_rate;
 344         }
 345
 346         return ~0;
 347 }
 348
 349 /*
 350  * sending SADB_GETSPI message to the kernel.
 351  * OUT:
 352  *      positive: success and return length sent.
 353  *      -1      : error occured, and set errno.
 354  */
 355 int
 356 pfkey_send_getspi(so, satype, mode, src, dst, min, max, reqid, seq)
 357         int so;
 358         u_int satype, mode;
 359         struct sockaddr *src, *dst;
 360         u_int32_t min, max, reqid, seq;
 361 {
 362         struct sadb_msg *newmsg;
 363         caddr_t ep;
 364         int len;
 365         int need_spirange = 0;
 366         caddr_t p;
 367         int plen;
 368
 369         /* validity check */
 370         if (src == NULL || dst == NULL) {
 371                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 372                 return -1;
 373         }
 374         if (src->sa_family != dst->sa_family) {
 375                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
 376                 return -1;
 377         }
 378         if (min > max || (min > 0 && min <= 255)) {
 379                 __ipsec_errcode = EIPSEC_INVAL_SPI;
 380                 return -1;
 381         }
 382         switch (src->sa_family) {
 383         case AF_INET:
 384                 plen = sizeof(struct in_addr) << 3;
 385                 break;
 386         case AF_INET6:
 387                 plen = sizeof(struct in6_addr) << 3;
 388                 break;
 389         default:
 390                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
 391                 return -1;
 392         }
 393
 394         /* create new sadb_msg to send. */
 395         len = sizeof(struct sadb_msg)
 396                 + sizeof(struct sadb_x_sa2)
 397                 + sizeof(struct sadb_address)
 398                 + PFKEY_ALIGN8(src->sa_len)
 399                 + sizeof(struct sadb_address)
 400                 + PFKEY_ALIGN8(dst->sa_len);
 401
 402         if (min > (u_int32_t)255 && max < (u_int32_t)~0) {
 403                 need_spirange++;
 404                 len += sizeof(struct sadb_spirange);
 405         }
 406
 407         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
 408                 __ipsec_set_strerror(strerror(errno));
 409                 return -1;
 410         }
 411         ep = ((caddr_t)newmsg) + len;
 412
 413         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, SADB_GETSPI,
 414             len, satype, seq, getpid());
 415         if (!p) {
 416                 free(newmsg);
 417                 return -1;
 418         }
 419
 420         p = pfkey_setsadbxsa2(p, ep, mode, reqid);
 421         if (!p) {
 422                 free(newmsg);
 423                 return -1;
 424         }
 425
 426         /* set sadb_address for source */
 427         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
 428             IPSEC_ULPROTO_ANY);
 429         if (!p) {
 430                 free(newmsg);
 431                 return -1;
 432         }
 433
 434         /* set sadb_address for destination */
 435         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
 436             IPSEC_ULPROTO_ANY);
 437         if (!p) {
 438                 free(newmsg);
 439                 return -1;
 440         }
 441
 442         /* proccessing spi range */
 443         if (need_spirange) {
 444                 struct sadb_spirange spirange;
 445
 446                 if (p + sizeof(spirange) > ep) {
 447                         free(newmsg);
 448                         return -1;
 449                 }
 450
 451                 memset(&spirange, 0, sizeof(spirange));
 452                 spirange.sadb_spirange_len = PFKEY_UNIT64(sizeof(spirange));
 453                 spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE;
 454                 spirange.sadb_spirange_min = min;
 455                 spirange.sadb_spirange_max = max;
 456
 457                 memcpy(p, &spirange, sizeof(spirange));
 458
 459                 p += sizeof(spirange);
 460         }
 461         if (p != ep) {
 462                 free(newmsg);
 463                 return -1;
 464         }
 465
 466         /* send message */
 467         len = pfkey_send(so, newmsg, len);
 468         free(newmsg);
 469
 470         if (len < 0)
 471                 return -1;
 472
 473         __ipsec_errcode = EIPSEC_NO_ERROR;
 474         return len;
 475 }
 476
 477 /*
 478  * sending SADB_UPDATE message to the kernel.
 479  * The length of key material is a_keylen + e_keylen.
 480  * OUT:
 481  *      positive: success and return length sent.
 482  *      -1      : error occured, and set errno.
 483  */
 484 int
 485 pfkey_send_update(so, satype, mode, src, dst, spi, reqid, wsize,
 486                 keymat, e_type, e_keylen, a_type, a_keylen, flags,
 487                 l_alloc, l_bytes, l_addtime, l_usetime, seq)
 488         int so;
 489         u_int satype, mode, wsize;
 490         struct sockaddr *src, *dst;
 491         u_int32_t spi, reqid;
 492         caddr_t keymat;
 493         u_int e_type, e_keylen, a_type, a_keylen, flags;
 494         u_int32_t l_alloc;
 495         u_int64_t l_bytes, l_addtime, l_usetime;
 496         u_int32_t seq;
 497 {
 498         int len;
 499         if ((len = pfkey_send_x1(so, SADB_UPDATE, satype, mode, src, dst, spi,
 500                         reqid, wsize,
 501                         keymat, e_type, e_keylen, a_type, a_keylen, flags,
 502                         l_alloc, l_bytes, l_addtime, l_usetime, seq)) < 0)
 503                 return -1;
 504
 505         return len;
 506 }
 507
 508 /*
 509  * sending SADB_ADD message to the kernel.
 510  * The length of key material is a_keylen + e_keylen.
 511  * OUT:
 512  *      positive: success and return length sent.
 513  *      -1      : error occured, and set errno.
 514  */
 515 int
 516 pfkey_send_add(so, satype, mode, src, dst, spi, reqid, wsize,
 517                 keymat, e_type, e_keylen, a_type, a_keylen, flags,
 518                 l_alloc, l_bytes, l_addtime, l_usetime, seq)
 519         int so;
 520         u_int satype, mode, wsize;
 521         struct sockaddr *src, *dst;
 522         u_int32_t spi, reqid;
 523         caddr_t keymat;
 524         u_int e_type, e_keylen, a_type, a_keylen, flags;
 525         u_int32_t l_alloc;
 526         u_int64_t l_bytes, l_addtime, l_usetime;
 527         u_int32_t seq;
 528 {
 529         int len;
 530         if ((len = pfkey_send_x1(so, SADB_ADD, satype, mode, src, dst, spi,
 531                         reqid, wsize,
 532                         keymat, e_type, e_keylen, a_type, a_keylen, flags,
 533                         l_alloc, l_bytes, l_addtime, l_usetime, seq)) < 0)
 534                 return -1;
 535
 536         return len;
 537 }
 538
 539 /*
 540  * sending SADB_DELETE message to the kernel.
 541  * OUT:
 542  *      positive: success and return length sent.
 543  *      -1      : error occured, and set errno.
 544  */
 545 int
 546 pfkey_send_delete(so, satype, mode, src, dst, spi)
 547         int so;
 548         u_int satype, mode;
 549         struct sockaddr *src, *dst;
 550         u_int32_t spi;
 551 {
 552         int len;
 553         if ((len = pfkey_send_x2(so, SADB_DELETE, satype, mode, src, dst, spi)) < 0)
 554                 return -1;
 555
 556         return len;
 557 }
 558
 559 /*
 560  * sending SADB_DELETE without spi to the kernel.  This is
 561  * the "delete all" request (an extension also present in
 562  * Solaris).
 563  *
 564  * OUT:
 565  *      positive: success and return length sent
 566  *      -1      : error occured, and set errno
 567  */
 568 int
 569 pfkey_send_delete_all(so, satype, mode, src, dst)
 570         int so;
 571         u_int satype, mode;
 572         struct sockaddr *src, *dst;
 573 {
 574         struct sadb_msg *newmsg;
 575         int len;
 576         caddr_t p;
 577         int plen;
 578         caddr_t ep;
 579
 580         (void)mode;
 581
 582         /* validity check */
 583         if (src == NULL || dst == NULL) {
 584                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 585                 return -1;
 586         }
 587         if (src->sa_family != dst->sa_family) {
 588                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
 589                 return -1;
 590         }
 591         switch (src->sa_family) {
 592         case AF_INET:
 593                 plen = sizeof(struct in_addr) << 3;
 594                 break;
 595         case AF_INET6:
 596                 plen = sizeof(struct in6_addr) << 3;
 597                 break;
 598         default:
 599                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
 600                 return -1;
 601         }
 602
 603         /* create new sadb_msg to reply. */
 604         len = sizeof(struct sadb_msg)
 605                 + sizeof(struct sadb_address)
 606                 + PFKEY_ALIGN8(src->sa_len)
 607                 + sizeof(struct sadb_address)
 608                 + PFKEY_ALIGN8(dst->sa_len);
 609
 610         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
 611                 __ipsec_set_strerror(strerror(errno));
 612                 return -1;
 613         }
 614         ep = ((caddr_t)newmsg) + len;
 615
 616         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, SADB_DELETE, len, satype, 0,
 617             getpid());
 618         if (!p) {
 619                 free(newmsg);
 620                 return -1;
 621         }
 622         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
 623             IPSEC_ULPROTO_ANY);
 624         if (!p) {
 625                 free(newmsg);
 626                 return -1;
 627         }
 628         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
 629             IPSEC_ULPROTO_ANY);
 630         if (!p || p != ep) {
 631                 free(newmsg);
 632                 return -1;
 633         }
 634
 635         /* send message */
 636         len = pfkey_send(so, newmsg, len);
 637         free(newmsg);
 638
 639         if (len < 0)
 640                 return -1;
 641
 642         __ipsec_errcode = EIPSEC_NO_ERROR;
 643         return len;
 644 }
 645
 646 /*
 647  * sending SADB_GET message to the kernel.
 648  * OUT:
 649  *      positive: success and return length sent.
 650  *      -1      : error occured, and set errno.
 651  */
 652 int
 653 pfkey_send_get(so, satype, mode, src, dst, spi)
 654         int so;
 655         u_int satype, mode;
 656         struct sockaddr *src, *dst;
 657         u_int32_t spi;
 658 {
 659         int len;
 660         if ((len = pfkey_send_x2(so, SADB_GET, satype, mode, src, dst, spi)) < 0)
 661                 return -1;
 662
 663         return len;
 664 }
 665
 666 /*
 667  * sending SADB_REGISTER message to the kernel.
 668  * OUT:
 669  *      positive: success and return length sent.
 670  *      -1      : error occured, and set errno.
 671  */
 672 int
 673 pfkey_send_register(so, satype)
 674         int so;
 675         u_int satype;
 676 {
 677         int len, algno;
 678
 679         if (satype == PF_UNSPEC) {
 680                 for (algno = 0;
 681                      (unsigned int)algno < sizeof(supported_map)/sizeof(supported_map[0]);
 682                      algno++) {
 683                         if (ipsec_supported[algno]) {
 684                                 free(ipsec_supported[algno]);
 685                                 ipsec_supported[algno] = NULL;
 686                         }
 687                 }
 688         } else {
 689                 algno = findsupportedmap(satype);
 690                 if (algno == -1) {
 691                         __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 692                         return -1;
 693                 }
 694
 695                 if (ipsec_supported[algno]) {
 696                         free(ipsec_supported[algno]);
 697                         ipsec_supported[algno] = NULL;
 698                 }
 699         }
 700
 701         if ((len = pfkey_send_x3(so, SADB_REGISTER, satype)) < 0)
 702                 return -1;
 703
 704         return len;
 705 }
 706
 707 /*
 708  * receiving SADB_REGISTER message from the kernel, and copy buffer for
 709  * sadb_supported returned into ipsec_supported.
 710  * OUT:
 711  *       0: success and return length sent.
 712  *      -1: error occured, and set errno.
 713  */
 714 int
 715 pfkey_recv_register(so)
 716         int so;
 717 {
 718         pid_t pid = getpid();
 719         struct sadb_msg *newmsg;
 720         int error = -1;
 721
 722         /* receive message */
 723         do {
 724                 if ((newmsg = pfkey_recv(so)) == NULL)
 725                         return -1;
 726         } while (newmsg->sadb_msg_type != SADB_REGISTER
 727             || (pid_t)newmsg->sadb_msg_pid != pid);
 728
 729         /* check and fix */
 730         newmsg->sadb_msg_len = PFKEY_UNUNIT64(newmsg->sadb_msg_len);
 731
 732         error = pfkey_set_supported(newmsg, newmsg->sadb_msg_len);
 733         free(newmsg);
 734
 735         if (error == 0)
 736                 __ipsec_errcode = EIPSEC_NO_ERROR;
 737
 738         return error;
 739 }
 740
 741 /*
 742  * receiving SADB_REGISTER message from the kernel, and copy buffer for
 743  * sadb_supported returned into ipsec_supported.
 744  * NOTE: sadb_msg_len must be host order.
 745  * IN:
 746  *      tlen: msg length, it's to makeing sure.
 747  * OUT:
 748  *       0: success and return length sent.
 749  *      -1: error occured, and set errno.
 750  */
 751 int
 752 pfkey_set_supported(msg, tlen)
 753         struct sadb_msg *msg;
 754         int tlen;
 755 {
 756         struct sadb_supported *sup;
 757         caddr_t p;
 758         caddr_t ep;
 759
 760         /* validity */
 761         if (msg->sadb_msg_len != tlen) {
 762                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 763                 return -1;
 764         }
 765
 766         p = (caddr_t)msg;
 767         ep = p + tlen;
 768
 769         p += sizeof(struct sadb_msg);
 770
 771         while (p < ep) {
 772                 sup = (struct sadb_supported *)p;
 773                 if (ep < p + sizeof(*sup) ||
 774                     (size_t)PFKEY_EXTLEN(sup) < sizeof(*sup) ||
 775                     ep < p + sup->sadb_supported_len) {
 776                         /* invalid format */
 777                         break;
 778                 }
 779
 780                 switch (sup->sadb_supported_exttype) {
 781                 case SADB_EXT_SUPPORTED_AUTH:
 782                 case SADB_EXT_SUPPORTED_ENCRYPT:
 783                         break;
 784                 default:
 785                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
 786                         return -1;
 787                 }
 788
 789                 /* fixed length */
 790                 sup->sadb_supported_len = PFKEY_EXTLEN(sup);
 791
 792                 /* set supported map */
 793                 if (setsupportedmap(sup) != 0)
 794                         return -1;
 795
 796                 p += sup->sadb_supported_len;
 797         }
 798
 799         if (p != ep) {
 800                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
 801                 return -1;
 802         }
 803
 804         __ipsec_errcode = EIPSEC_NO_ERROR;
 805
 806         return 0;
 807 }
 808
 809 /*
 810  * sending SADB_FLUSH message to the kernel.
 811  * OUT:
 812  *      positive: success and return length sent.
 813  *      -1      : error occured, and set errno.
 814  */
 815 int
 816 pfkey_send_flush(so, satype)
 817         int so;
 818         u_int satype;
 819 {
 820         int len;
 821
 822         if ((len = pfkey_send_x3(so, SADB_FLUSH, satype)) < 0)
 823                 return -1;
 824
 825         return len;
 826 }
 827
 828 /*
 829  * sending SADB_DUMP message to the kernel.
 830  * OUT:
 831  *      positive: success and return length sent.
 832  *      -1      : error occured, and set errno.
 833  */
 834 int
 835 pfkey_send_dump(so, satype)
 836         int so;
 837         u_int satype;
 838 {
 839         int len;
 840
 841         if ((len = pfkey_send_x3(so, SADB_DUMP, satype)) < 0)
 842                 return -1;
 843
 844         return len;
 845 }
 846
 847 /*
 848  * sending SADB_X_PROMISC message to the kernel.
 849  * NOTE that this function handles promisc mode toggle only.
 850  * IN:
 851  *      flag:   set promisc off if zero, set promisc on if non-zero.
 852  * OUT:
 853  *      positive: success and return length sent.
 854  *      -1      : error occured, and set errno.
 855  *      0     : error occured, and set errno.
 856  *      others: a pointer to new allocated buffer in which supported
 857  *              algorithms is.
 858  */
 859 int
 860 pfkey_send_promisc_toggle(so, flag)
 861         int so;
 862         int flag;
 863 {
 864         int len;
 865
 866         if ((len = pfkey_send_x3(so, SADB_X_PROMISC, (flag ? 1 : 0))) < 0)
 867                 return -1;
 868
 869         return len;
 870 }
 871
 872 /*
 873  * sending SADB_X_SPDADD message to the kernel.
 874  * OUT:
 875  *      positive: success and return length sent.
 876  *      -1      : error occured, and set errno.
 877  */
 878 int
 879 pfkey_send_spdadd(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
 880         int so;
 881         struct sockaddr *src, *dst;
 882         u_int prefs, prefd, proto;
 883         caddr_t policy;
 884         int policylen;
 885         u_int32_t seq;
 886 {
 887         int len;
 888
 889         if ((len = pfkey_send_x4(so, SADB_X_SPDADD,
 890                                 src, prefs, dst, prefd, proto,
 891                                 0, 0,
 892                                 policy, policylen, seq)) < 0)
 893                 return -1;
 894
 895         return len;
 896 }
 897
 898 /*
 899  * sending SADB_X_SPDADD message to the kernel.
 900  * OUT:
 901  *      positive: success and return length sent.
 902  *      -1      : error occured, and set errno.
 903  */
 904 int
 905 pfkey_send_spdadd2(so, src, prefs, dst, prefd, proto, ltime, vtime,
 906                 policy, policylen, seq)
 907         int so;
 908         struct sockaddr *src, *dst;
 909         u_int prefs, prefd, proto;
 910         u_int64_t ltime, vtime;
 911         caddr_t policy;
 912         int policylen;
 913         u_int32_t seq;
 914 {
 915         int len;
 916
 917         if ((len = pfkey_send_x4(so, SADB_X_SPDADD,
 918                                 src, prefs, dst, prefd, proto,
 919                                 ltime, vtime,
 920                                 policy, policylen, seq)) < 0)
 921                 return -1;
 922
 923         return len;
 924 }
 925
 926 /*
 927  * sending SADB_X_SPDUPDATE message to the kernel.
 928  * OUT:
 929  *      positive: success and return length sent.
 930  *      -1      : error occured, and set errno.
 931  */
 932 int
 933 pfkey_send_spdupdate(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
 934         int so;
 935         struct sockaddr *src, *dst;
 936         u_int prefs, prefd, proto;
 937         caddr_t policy;
 938         int policylen;
 939         u_int32_t seq;
 940 {
 941         int len;
 942
 943         if ((len = pfkey_send_x4(so, SADB_X_SPDUPDATE,
 944                                 src, prefs, dst, prefd, proto,
 945                                 0, 0,
 946                                 policy, policylen, seq)) < 0)
 947                 return -1;
 948
 949         return len;
 950 }
 951
 952 /*
 953  * sending SADB_X_SPDUPDATE message to the kernel.
 954  * OUT:
 955  *      positive: success and return length sent.
 956  *      -1      : error occured, and set errno.
 957  */
 958 int
 959 pfkey_send_spdupdate2(so, src, prefs, dst, prefd, proto, ltime, vtime,
 960                 policy, policylen, seq)
 961         int so;
 962         struct sockaddr *src, *dst;
 963         u_int prefs, prefd, proto;
 964         u_int64_t ltime, vtime;
 965         caddr_t policy;
 966         int policylen;
 967         u_int32_t seq;
 968 {
 969         int len;
 970
 971         if ((len = pfkey_send_x4(so, SADB_X_SPDUPDATE,
 972                                 src, prefs, dst, prefd, proto,
 973                                 ltime, vtime,
 974                                 policy, policylen, seq)) < 0)
 975                 return -1;
 976
 977         return len;
 978 }
 979
 980 /*
 981  * sending SADB_X_SPDDELETE message to the kernel.
 982  * OUT:
 983  *      positive: success and return length sent.
 984  *      -1      : error occured, and set errno.
 985  */
 986 int
 987 pfkey_send_spddelete(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
 988         int so;
 989         struct sockaddr *src, *dst;
 990         u_int prefs, prefd, proto;
 991         caddr_t policy;
 992         int policylen;
 993         u_int32_t seq;
 994 {
 995         int len;
 996
 997         if (policylen != sizeof(struct sadb_x_policy)) {
 998                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 999                 return -1;
1000         }
1001
1002         if ((len = pfkey_send_x4(so, SADB_X_SPDDELETE,
1003                                 src, prefs, dst, prefd, proto,
1004                                 0, 0,
1005                                 policy, policylen, seq)) < 0)
1006                 return -1;
1007
1008         return len;
1009 }
1010
1011 /*
1012  * sending SADB_X_SPDDELETE message to the kernel.
1013  * OUT:
1014  *      positive: success and return length sent.
1015  *      -1      : error occured, and set errno.
1016  */
1017 int
1018 pfkey_send_spddelete2(so, spid)
1019         int so;
1020         u_int32_t spid;
1021 {
1022         int len;
1023
1024         if ((len = pfkey_send_x5(so, SADB_X_SPDDELETE2, spid)) < 0)
1025                 return -1;
1026
1027         return len;
1028 }
1029
1030 /*
1031  * sending SADB_X_SPDGET message to the kernel.
1032  * OUT:
1033  *      positive: success and return length sent.
1034  *      -1      : error occured, and set errno.
1035  */
1036 int
1037 pfkey_send_spdget(so, spid)
1038         int so;
1039         u_int32_t spid;
1040 {
1041         int len;
1042
1043         if ((len = pfkey_send_x5(so, SADB_X_SPDGET, spid)) < 0)
1044                 return -1;
1045
1046         return len;
1047 }
1048
1049 /*
1050  * sending SADB_X_SPDSETIDX message to the kernel.
1051  * OUT:
1052  *      positive: success and return length sent.
1053  *      -1      : error occured, and set errno.
1054  */
1055 int
1056 pfkey_send_spdsetidx(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
1057         int so;
1058         struct sockaddr *src, *dst;
1059         u_int prefs, prefd, proto;
1060         caddr_t policy;
1061         int policylen;
1062         u_int32_t seq;
1063 {
1064         int len;
1065
1066         if (policylen != sizeof(struct sadb_x_policy)) {
1067                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1068                 return -1;
1069         }
1070
1071         if ((len = pfkey_send_x4(so, SADB_X_SPDSETIDX,
1072                                 src, prefs, dst, prefd, proto,
1073                                 0, 0,
1074                                 policy, policylen, seq)) < 0)
1075                 return -1;
1076
1077         return len;
1078 }
1079
1080 /*
1081  * sending SADB_SPDFLUSH message to the kernel.
1082  * OUT:
1083  *      positive: success and return length sent.
1084  *      -1      : error occured, and set errno.
1085  */
1086 int
1087 pfkey_send_spdflush(so)
1088         int so;
1089 {
1090         int len;
1091
1092         if ((len = pfkey_send_x3(so, SADB_X_SPDFLUSH, SADB_SATYPE_UNSPEC)) < 0)
1093                 return -1;
1094
1095         return len;
1096 }
1097
1098 /*
1099  * sending SADB_SPDDUMP message to the kernel.
1100  * OUT:
1101  *      positive: success and return length sent.
1102  *      -1      : error occured, and set errno.
1103  */
1104 int
1105 pfkey_send_spddump(so)
1106         int so;
1107 {
1108         int len;
1109
1110         if ((len = pfkey_send_x3(so, SADB_X_SPDDUMP, SADB_SATYPE_UNSPEC)) < 0)
1111                 return -1;
1112
1113         return len;
1114 }
1115
1116 /* sending SADB_ADD or SADB_UPDATE message to the kernel */
1117 static int
1118 pfkey_send_x1(so, type, satype, mode, src, dst, spi, reqid, wsize,
1119                 keymat, e_type, e_keylen, a_type, a_keylen, flags,
1120                 l_alloc, l_bytes, l_addtime, l_usetime, seq)
1121         int so;
1122         u_int type, satype, mode;
1123         struct sockaddr *src, *dst;
1124         u_int32_t spi, reqid;
1125         u_int wsize;
1126         caddr_t keymat;
1127         u_int e_type, e_keylen, a_type, a_keylen, flags;
1128         u_int32_t l_alloc, l_bytes, l_addtime, l_usetime, seq;
1129 {
1130         struct sadb_msg *newmsg;
1131         int len;
1132         caddr_t p;
1133         int plen;
1134         caddr_t ep;
1135
1136         /* validity check */
1137         if (src == NULL || dst == NULL) {
1138                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1139                 return -1;
1140         }
1141         if (src->sa_family != dst->sa_family) {
1142                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1143                 return -1;
1144         }
1145         switch (src->sa_family) {
1146         case AF_INET:
1147                 plen = sizeof(struct in_addr) << 3;
1148                 break;
1149         case AF_INET6:
1150                 plen = sizeof(struct in6_addr) << 3;
1151                 break;
1152         default:
1153                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1154                 return -1;
1155         }
1156
1157         switch (satype) {
1158         case SADB_SATYPE_ESP:
1159                 if (e_type == SADB_EALG_NONE) {
1160                         __ipsec_errcode = EIPSEC_NO_ALGS;
1161                         return -1;
1162                 }
1163                 break;
1164         case SADB_SATYPE_AH:
1165                 if (e_type != SADB_EALG_NONE) {
1166                         __ipsec_errcode = EIPSEC_INVAL_ALGS;
1167                         return -1;
1168                 }
1169                 if (a_type == SADB_AALG_NONE) {
1170                         __ipsec_errcode = EIPSEC_NO_ALGS;
1171                         return -1;
1172                 }
1173                 break;
1174         case SADB_X_SATYPE_IPCOMP:
1175                 if (e_type == SADB_X_CALG_NONE) {
1176                         __ipsec_errcode = EIPSEC_INVAL_ALGS;
1177                         return -1;
1178                 }
1179                 if (a_type != SADB_AALG_NONE) {
1180                         __ipsec_errcode = EIPSEC_NO_ALGS;
1181                         return -1;
1182                 }
1183                 break;
1184         default:
1185                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1186                 return -1;
1187         }
1188
1189         /* create new sadb_msg to reply. */
1190         len = sizeof(struct sadb_msg)
1191                 + sizeof(struct sadb_sa)
1192                 + sizeof(struct sadb_x_sa2)
1193                 + sizeof(struct sadb_address)
1194                 + PFKEY_ALIGN8(src->sa_len)
1195                 + sizeof(struct sadb_address)
1196                 + PFKEY_ALIGN8(dst->sa_len)
1197                 + sizeof(struct sadb_lifetime)
1198                 + sizeof(struct sadb_lifetime);
1199
1200         if (e_type != SADB_EALG_NONE)
1201                 len += (sizeof(struct sadb_key) + PFKEY_ALIGN8(e_keylen));
1202         if (a_type != SADB_AALG_NONE)
1203                 len += (sizeof(struct sadb_key) + PFKEY_ALIGN8(a_keylen));
1204
1205         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1206                 __ipsec_set_strerror(strerror(errno));
1207                 return -1;
1208         }
1209         ep = ((caddr_t)newmsg) + len;
1210
1211         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1212                              satype, seq, getpid());
1213         if (!p) {
1214                 free(newmsg);
1215                 return -1;
1216         }
1217         p = pfkey_setsadbsa(p, ep, spi, wsize, a_type, e_type, flags);
1218         if (!p) {
1219                 free(newmsg);
1220                 return -1;
1221         }
1222         p = pfkey_setsadbxsa2(p, ep, mode, reqid);
1223         if (!p) {
1224                 free(newmsg);
1225                 return -1;
1226         }
1227         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
1228             IPSEC_ULPROTO_ANY);
1229         if (!p) {
1230                 free(newmsg);
1231                 return -1;
1232         }
1233         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
1234             IPSEC_ULPROTO_ANY);
1235         if (!p) {
1236                 free(newmsg);
1237                 return -1;
1238         }
1239
1240         if (e_type != SADB_EALG_NONE) {
1241                 p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_ENCRYPT,
1242                                    keymat, e_keylen);
1243                 if (!p) {
1244                         free(newmsg);
1245                         return -1;
1246                 }
1247         }
1248         if (a_type != SADB_AALG_NONE) {
1249                 p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_AUTH,
1250                                    keymat + e_keylen, a_keylen);
1251                 if (!p) {
1252                         free(newmsg);
1253                         return -1;
1254                 }
1255         }
1256
1257         /* set sadb_lifetime for destination */
1258         p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_HARD,
1259                         l_alloc, l_bytes, l_addtime, l_usetime);
1260         if (!p) {
1261                 free(newmsg);
1262                 return -1;
1263         }
1264         p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_SOFT,
1265                         l_alloc, l_bytes, l_addtime, l_usetime);
1266         if (!p || p != ep) {
1267                 free(newmsg);
1268                 return -1;
1269         }
1270
1271         /* send message */
1272         len = pfkey_send(so, newmsg, len);
1273         free(newmsg);
1274
1275         if (len < 0)
1276                 return -1;
1277
1278         __ipsec_errcode = EIPSEC_NO_ERROR;
1279         return len;
1280 }
1281
1282 /* sending SADB_DELETE or SADB_GET message to the kernel */
1283 static int
1284 pfkey_send_x2(so, type, satype, mode, src, dst, spi)
1285         int so;
1286         u_int type, satype, mode;
1287         struct sockaddr *src, *dst;
1288         u_int32_t spi;
1289 {
1290         struct sadb_msg *newmsg;
1291         int len;
1292         caddr_t p;
1293         int plen;
1294         caddr_t ep;
1295
1296         (void)mode;
1297
1298         /* validity check */
1299         if (src == NULL || dst == NULL) {
1300                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1301                 return -1;
1302         }
1303         if (src->sa_family != dst->sa_family) {
1304                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1305                 return -1;
1306         }
1307         switch (src->sa_family) {
1308         case AF_INET:
1309                 plen = sizeof(struct in_addr) << 3;
1310                 break;
1311         case AF_INET6:
1312                 plen = sizeof(struct in6_addr) << 3;
1313                 break;
1314         default:
1315                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1316                 return -1;
1317         }
1318
1319         /* create new sadb_msg to reply. */
1320         len = sizeof(struct sadb_msg)
1321                 + sizeof(struct sadb_sa)
1322                 + sizeof(struct sadb_address)
1323                 + PFKEY_ALIGN8(src->sa_len)
1324                 + sizeof(struct sadb_address)
1325                 + PFKEY_ALIGN8(dst->sa_len);
1326
1327         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1328                 __ipsec_set_strerror(strerror(errno));
1329                 return -1;
1330         }
1331         ep = ((caddr_t)newmsg) + len;
1332
1333         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len, satype, 0,
1334             getpid());
1335         if (!p) {
1336                 free(newmsg);
1337                 return -1;
1338         }
1339         p = pfkey_setsadbsa(p, ep, spi, 0, 0, 0, 0);
1340         if (!p) {
1341                 free(newmsg);
1342                 return -1;
1343         }
1344         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
1345             IPSEC_ULPROTO_ANY);
1346         if (!p) {
1347                 free(newmsg);
1348                 return -1;
1349         }
1350         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
1351             IPSEC_ULPROTO_ANY);
1352         if (!p || p != ep) {
1353                 free(newmsg);
1354                 return -1;
1355         }
1356
1357         /* send message */
1358         len = pfkey_send(so, newmsg, len);
1359         free(newmsg);
1360
1361         if (len < 0)
1362                 return -1;
1363
1364         __ipsec_errcode = EIPSEC_NO_ERROR;
1365         return len;
1366 }
1367
1368 /*
1369  * sending SADB_REGISTER, SADB_FLUSH, SADB_DUMP or SADB_X_PROMISC message
1370  * to the kernel
1371  */
1372 static int
1373 pfkey_send_x3(so, type, satype)
1374         int so;
1375         u_int type, satype;
1376 {
1377         struct sadb_msg *newmsg;
1378         int len;
1379         caddr_t p;
1380         caddr_t ep;
1381
1382         /* validity check */
1383         switch (type) {
1384         case SADB_X_PROMISC:
1385                 if (satype != 0 && satype != 1) {
1386                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1387                         return -1;
1388                 }
1389                 break;
1390         default:
1391                 switch (satype) {
1392                 case SADB_SATYPE_UNSPEC:
1393                 case SADB_SATYPE_AH:
1394                 case SADB_SATYPE_ESP:
1395                 case SADB_X_SATYPE_IPCOMP:
1396                         break;
1397                 default:
1398                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1399                         return -1;
1400                 }
1401         }
1402
1403         /* create new sadb_msg to send. */
1404         len = sizeof(struct sadb_msg);
1405
1406         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1407                 __ipsec_set_strerror(strerror(errno));
1408                 return -1;
1409         }
1410         ep = ((caddr_t)newmsg) + len;
1411
1412         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len, satype, 0,
1413             getpid());
1414         if (!p || p != ep) {
1415                 free(newmsg);
1416                 return -1;
1417         }
1418
1419         /* send message */
1420         len = pfkey_send(so, newmsg, len);
1421         free(newmsg);
1422
1423         if (len < 0)
1424                 return -1;
1425
1426         __ipsec_errcode = EIPSEC_NO_ERROR;
1427         return len;
1428 }
1429
1430 /* sending SADB_X_SPDADD message to the kernel */
1431 static int
1432 pfkey_send_x4(so, type, src, prefs, dst, prefd, proto,
1433                 ltime, vtime, policy, policylen, seq)
1434         int so;
1435         struct sockaddr *src, *dst;
1436         u_int type, prefs, prefd, proto;
1437         u_int64_t ltime, vtime;
1438         char *policy;
1439         int policylen;
1440         u_int32_t seq;
1441 {
1442         struct sadb_msg *newmsg;
1443         int len;
1444         caddr_t p;
1445         int plen;
1446         caddr_t ep;
1447
1448         /* validity check */
1449         if (src == NULL || dst == NULL) {
1450                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1451                 return -1;
1452         }
1453         if (src->sa_family != dst->sa_family) {
1454                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1455                 return -1;
1456         }
1457
1458         switch (src->sa_family) {
1459         case AF_INET:
1460                 plen = sizeof(struct in_addr) << 3;
1461                 break;
1462         case AF_INET6:
1463                 plen = sizeof(struct in6_addr) << 3;
1464                 break;
1465         default:
1466                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1467                 return -1;
1468         }
1469         if (prefs > (u_int)plen || prefd > (u_int)plen) {
1470                 __ipsec_errcode = EIPSEC_INVAL_PREFIXLEN;
1471                 return -1;
1472         }
1473
1474         /* create new sadb_msg to reply. */
1475         len = sizeof(struct sadb_msg)
1476                 + sizeof(struct sadb_address)
1477                 + PFKEY_ALIGN8(src->sa_len)
1478                 + sizeof(struct sadb_address)
1479                 + PFKEY_ALIGN8(src->sa_len)
1480                 + sizeof(struct sadb_lifetime)
1481                 + policylen;
1482
1483         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1484                 __ipsec_set_strerror(strerror(errno));
1485                 return -1;
1486         }
1487         ep = ((caddr_t)newmsg) + len;
1488
1489         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1490             SADB_SATYPE_UNSPEC, seq, getpid());
1491         if (!p) {
1492                 free(newmsg);
1493                 return -1;
1494         }
1495         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, prefs, proto);
1496         if (!p) {
1497                 free(newmsg);
1498                 return -1;
1499         }
1500         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, prefd, proto);
1501         if (!p) {
1502                 free(newmsg);
1503                 return -1;
1504         }
1505         p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_HARD,
1506                         0, 0, ltime, vtime);
1507         if (!p || p + policylen != ep) {
1508                 free(newmsg);
1509                 return -1;
1510         }
1511         memcpy(p, policy, policylen);
1512
1513         /* send message */
1514         len = pfkey_send(so, newmsg, len);
1515         free(newmsg);
1516
1517         if (len < 0)
1518                 return -1;
1519
1520         __ipsec_errcode = EIPSEC_NO_ERROR;
1521         return len;
1522 }
1523
1524 /* sending SADB_X_SPDGET or SADB_X_SPDDELETE message to the kernel */
1525 static int
1526 pfkey_send_x5(so, type, spid)
1527         int so;
1528         u_int type;
1529         u_int32_t spid;
1530 {
1531         struct sadb_msg *newmsg;
1532         struct sadb_x_policy xpl;
1533         int len;
1534         caddr_t p;
1535         caddr_t ep;
1536
1537         /* create new sadb_msg to reply. */
1538         len = sizeof(struct sadb_msg)
1539                 + sizeof(xpl);
1540
1541         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1542                 __ipsec_set_strerror(strerror(errno));
1543                 return -1;
1544         }
1545         ep = ((caddr_t)newmsg) + len;
1546
1547         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1548             SADB_SATYPE_UNSPEC, 0, getpid());
1549         if (!p) {
1550                 free(newmsg);
1551                 return -1;
1552         }
1553
1554         if (p + sizeof(xpl) != ep) {
1555                 free(newmsg);
1556                 return -1;
1557         }
1558         memset(&xpl, 0, sizeof(xpl));
1559         xpl.sadb_x_policy_len = PFKEY_UNUNIT64(sizeof(xpl));
1560         xpl.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
1561         xpl.sadb_x_policy_id = spid;
1562         memcpy(p, &xpl, sizeof(xpl));
1563
1564         /* send message */
1565         len = pfkey_send(so, newmsg, len);
1566         free(newmsg);
1567
1568         if (len < 0)
1569                 return -1;
1570
1571         __ipsec_errcode = EIPSEC_NO_ERROR;
1572         return len;
1573 }
1574
1575 /*
1576  * open a socket.
1577  * OUT:
1578  *      -1: fail.
1579  *      others : success and return value of socket.
1580  */
1581 int
1582 pfkey_open()
1583 {
1584         int so;
1585         const int bufsiz = 128 * 1024;  /*is 128K enough?*/
1586
1587         if ((so = socket(PF_KEY, SOCK_RAW, PF_KEY_V2)) < 0) {
1588                 __ipsec_set_strerror(strerror(errno));
1589                 return -1;
1590         }
1591
1592         /*
1593          * This is a temporary workaround for KAME PR 154.
1594          * Don't really care even if it fails.
1595          */
1596         (void)setsockopt(so, SOL_SOCKET, SO_SNDBUF, &bufsiz, sizeof(bufsiz));
1597         (void)setsockopt(so, SOL_SOCKET, SO_RCVBUF, &bufsiz, sizeof(bufsiz));
1598
1599         __ipsec_errcode = EIPSEC_NO_ERROR;
1600         return so;
1601 }
1602
1603 /*
1604  * close a socket.
1605  * OUT:
1606  *       0: success.
1607  *      -1: fail.
1608  */
1609 void
1610 pfkey_close(so)
1611         int so;
1612 {
1613         (void)close(so);
1614
1615         __ipsec_errcode = EIPSEC_NO_ERROR;
1616         return;
1617 }
1618
1619 /*
1620  * receive sadb_msg data, and return pointer to new buffer allocated.
1621  * Must free this buffer later.
1622  * OUT:
1623  *      NULL    : error occured.
1624  *      others  : a pointer to sadb_msg structure.
1625  *
1626  * XXX should be rewritten to pass length explicitly
1627  */
1628 struct sadb_msg *
1629 pfkey_recv(so)
1630         int so;
1631 {
1632         struct sadb_msg buf, *newmsg;
1633         int len, reallen;
1634
1635         while ((len = recv(so, (caddr_t)&buf, sizeof(buf), MSG_PEEK)) < 0) {
1636                 if (errno == EINTR)
1637                         continue;
1638                 __ipsec_set_strerror(strerror(errno));
1639                 return NULL;
1640         }
1641
1642         if ((size_t)len < sizeof(buf)) {
1643                 recv(so, (caddr_t)&buf, sizeof(buf), 0);
1644                 __ipsec_errcode = EIPSEC_MAX;
1645                 return NULL;
1646         }
1647
1648         /* read real message */
1649         reallen = PFKEY_UNUNIT64(buf.sadb_msg_len);
1650         if ((newmsg = CALLOC(reallen, struct sadb_msg *)) == 0) {
1651                 __ipsec_set_strerror(strerror(errno));
1652                 return NULL;
1653         }
1654
1655         while ((len = recv(so, (caddr_t)newmsg, reallen, 0)) < 0) {
1656                 if (errno == EINTR)
1657                         continue;
1658                 __ipsec_set_strerror(strerror(errno));
1659                 free(newmsg);
1660                 return NULL;
1661         }
1662
1663         if (len != reallen) {
1664                 __ipsec_errcode = EIPSEC_SYSTEM_ERROR;
1665                 free(newmsg);
1666                 return NULL;
1667         }
1668
1669         /* don't trust what the kernel says, validate! */
1670         if (PFKEY_UNUNIT64(newmsg->sadb_msg_len) != len) {
1671                 __ipsec_errcode = EIPSEC_SYSTEM_ERROR;
1672                 free(newmsg);
1673                 return NULL;
1674         }
1675
1676         __ipsec_errcode = EIPSEC_NO_ERROR;
1677         return newmsg;
1678 }
1679
1680 /*
1681  * send message to a socket.
1682  * OUT:
1683  *       others: success and return length sent.
1684  *      -1     : fail.
1685  */
1686 int
1687 pfkey_send(so, msg, len)
1688         int so;
1689         struct sadb_msg *msg;
1690         int len;
1691 {
1692         if ((len = send(so, (caddr_t)msg, len, 0)) < 0) {
1693                 __ipsec_set_strerror(strerror(errno));
1694                 return -1;
1695         }
1696
1697         __ipsec_errcode = EIPSEC_NO_ERROR;
1698         return len;
1699 }
1700
1701 /*
1702  * %%% Utilities
1703  * NOTE: These functions are derived from netkey/key.c in KAME.
1704  */
1705 /*
1706  * set the pointer to each header in this message buffer.
1707  * IN:  msg: pointer to message buffer.
1708  *      mhp: pointer to the buffer initialized like below:
1709  *              caddr_t mhp[SADB_EXT_MAX + 1];
1710  * OUT: -1: invalid.
1711  *       0: valid.
1712  *
1713  * XXX should be rewritten to obtain length explicitly
1714  */
1715 int
1716 pfkey_align(msg, mhp)
1717         struct sadb_msg *msg;
1718         caddr_t *mhp;
1719 {
1720         struct sadb_ext *ext;
1721         int i;
1722         caddr_t p;
1723         caddr_t ep;     /* XXX should be passed from upper layer */
1724
1725         /* validity check */
1726         if (msg == NULL || mhp == NULL) {
1727                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1728                 return -1;
1729         }
1730
1731         /* initialize */
1732         for (i = 0; i < SADB_EXT_MAX + 1; i++)
1733                 mhp[i] = NULL;
1734
1735         mhp[0] = (caddr_t)msg;
1736
1737         /* initialize */
1738         p = (caddr_t) msg;
1739         ep = p + PFKEY_UNUNIT64(msg->sadb_msg_len);
1740
1741         /* skip base header */
1742         p += sizeof(struct sadb_msg);
1743
1744         while (p < ep) {
1745                 ext = (struct sadb_ext *)p;
1746                 if (ep < p + sizeof(*ext) || (size_t)PFKEY_EXTLEN(ext) < sizeof(*ext) ||
1747                     ep < p + PFKEY_EXTLEN(ext)) {
1748                         /* invalid format */
1749                         break;
1750                 }
1751
1752                 /* duplicate check */
1753                 /* XXX Are there duplication either KEY_AUTH or KEY_ENCRYPT ?*/
1754                 if (mhp[ext->sadb_ext_type] != NULL) {
1755                         __ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
1756                         return -1;
1757                 }
1758
1759                 /* set pointer */
1760                 switch (ext->sadb_ext_type) {
1761                 case SADB_EXT_SA:
1762                 case SADB_EXT_LIFETIME_CURRENT:
1763                 case SADB_EXT_LIFETIME_HARD:
1764                 case SADB_EXT_LIFETIME_SOFT:
1765                 case SADB_EXT_ADDRESS_SRC:
1766                 case SADB_EXT_ADDRESS_DST:
1767                 case SADB_EXT_ADDRESS_PROXY:
1768                 case SADB_EXT_KEY_AUTH:
1769                         /* XXX should to be check weak keys. */
1770                 case SADB_EXT_KEY_ENCRYPT:
1771                         /* XXX should to be check weak keys. */
1772                 case SADB_EXT_IDENTITY_SRC:
1773                 case SADB_EXT_IDENTITY_DST:
1774                 case SADB_EXT_SENSITIVITY:
1775                 case SADB_EXT_PROPOSAL:
1776                 case SADB_EXT_SUPPORTED_AUTH:
1777                 case SADB_EXT_SUPPORTED_ENCRYPT:
1778                 case SADB_EXT_SPIRANGE:
1779                 case SADB_X_EXT_POLICY:
1780                 case SADB_X_EXT_SA2:
1781                         mhp[ext->sadb_ext_type] = (caddr_t)ext;
1782                         break;
1783                 default:
1784                         __ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
1785                         return -1;
1786                 }
1787
1788                 p += PFKEY_EXTLEN(ext);
1789         }
1790
1791         if (p != ep) {
1792                 __ipsec_errcode = EIPSEC_INVAL_SADBMSG;
1793                 return -1;
1794         }
1795
1796         __ipsec_errcode = EIPSEC_NO_ERROR;
1797         return 0;
1798 }
1799
1800 /*
1801  * check basic usage for sadb_msg,
1802  * NOTE: This routine is derived from netkey/key.c in KAME.
1803  * IN:  msg: pointer to message buffer.
1804  *      mhp: pointer to the buffer initialized like below:
1805  *
1806  *              caddr_t mhp[SADB_EXT_MAX + 1];
1807  *
1808  * OUT: -1: invalid.
1809  *       0: valid.
1810  */
1811 int
1812 pfkey_check(mhp)
1813         caddr_t *mhp;
1814 {
1815         struct sadb_msg *msg;
1816
1817         /* validity check */
1818         if (mhp == NULL || mhp[0] == NULL) {
1819                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1820                 return -1;
1821         }
1822
1823         msg = (struct sadb_msg *)mhp[0];
1824
1825         /* check version */
1826         if (msg->sadb_msg_version != PF_KEY_V2) {
1827                 __ipsec_errcode = EIPSEC_INVAL_VERSION;
1828                 return -1;
1829         }
1830
1831         /* check type */
1832         if (msg->sadb_msg_type > SADB_MAX) {
1833                 __ipsec_errcode = EIPSEC_INVAL_MSGTYPE;
1834                 return -1;
1835         }
1836
1837         /* check SA type */
1838         switch (msg->sadb_msg_satype) {
1839         case SADB_SATYPE_UNSPEC:
1840                 switch (msg->sadb_msg_type) {
1841                 case SADB_GETSPI:
1842                 case SADB_UPDATE:
1843                 case SADB_ADD:
1844                 case SADB_DELETE:
1845                 case SADB_GET:
1846                 case SADB_ACQUIRE:
1847                 case SADB_EXPIRE:
1848                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1849                         return -1;
1850                 }
1851                 break;
1852         case SADB_SATYPE_ESP:
1853         case SADB_SATYPE_AH:
1854         case SADB_X_SATYPE_IPCOMP:
1855                 switch (msg->sadb_msg_type) {
1856                 case SADB_X_SPDADD:
1857                 case SADB_X_SPDDELETE:
1858                 case SADB_X_SPDGET:
1859                 case SADB_X_SPDDUMP:
1860                 case SADB_X_SPDFLUSH:
1861                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1862                         return -1;
1863                 }
1864                 break;
1865         case SADB_SATYPE_RSVP:
1866         case SADB_SATYPE_OSPFV2:
1867         case SADB_SATYPE_RIPV2:
1868         case SADB_SATYPE_MIP:
1869                 __ipsec_errcode = EIPSEC_NOT_SUPPORTED;
1870                 return -1;
1871         case 1: /* XXX: What does it do ? */
1872                 if (msg->sadb_msg_type == SADB_X_PROMISC)
1873                         break;
1874                 /*FALLTHROUGH*/
1875         default:
1876                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1877                 return -1;
1878         }
1879
1880         /* check field of upper layer protocol and address family */
1881         if (mhp[SADB_EXT_ADDRESS_SRC] != NULL
1882          && mhp[SADB_EXT_ADDRESS_DST] != NULL) {
1883                 struct sadb_address *src0, *dst0;
1884
1885                 src0 = (struct sadb_address *)(mhp[SADB_EXT_ADDRESS_SRC]);
1886                 dst0 = (struct sadb_address *)(mhp[SADB_EXT_ADDRESS_DST]);
1887
1888                 if (src0->sadb_address_proto != dst0->sadb_address_proto) {
1889                         __ipsec_errcode = EIPSEC_PROTO_MISMATCH;
1890                         return -1;
1891                 }
1892
1893                 if (PFKEY_ADDR_SADDR(src0)->sa_family
1894                  != PFKEY_ADDR_SADDR(dst0)->sa_family) {
1895                         __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1896                         return -1;
1897                 }
1898
1899                 switch (PFKEY_ADDR_SADDR(src0)->sa_family) {
1900                 case AF_INET:
1901                 case AF_INET6:
1902                         break;
1903                 default:
1904                         __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1905                         return -1;
1906                 }
1907
1908                 /*
1909                  * prefixlen == 0 is valid because there must be the case
1910                  * all addresses are matched.
1911                  */
1912         }
1913
1914         __ipsec_errcode = EIPSEC_NO_ERROR;
1915         return 0;
1916 }
1917
1918 /*
1919  * set data into sadb_msg.
1920  * `buf' must has been allocated sufficiently.
1921  */
1922 static caddr_t
1923 pfkey_setsadbmsg(buf, lim, type, tlen, satype, seq, pid)
1924         caddr_t buf;
1925         caddr_t lim;
1926         u_int type, satype;
1927         u_int tlen;
1928         u_int32_t seq;
1929         pid_t pid;
1930 {
1931         struct sadb_msg *p;
1932         u_int len;
1933
1934         p = (struct sadb_msg *)buf;
1935         len = sizeof(struct sadb_msg);
1936
1937         if (buf + len > lim)
1938                 return NULL;
1939
1940         memset(p, 0, len);
1941         p->sadb_msg_version = PF_KEY_V2;
1942         p->sadb_msg_type = type;
1943         p->sadb_msg_errno = 0;
1944         p->sadb_msg_satype = satype;
1945         p->sadb_msg_len = PFKEY_UNIT64(tlen);
1946         p->sadb_msg_reserved = 0;
1947         p->sadb_msg_seq = seq;
1948         p->sadb_msg_pid = (u_int32_t)pid;
1949
1950         return(buf + len);
1951 }
1952
1953 /*
1954  * copy secasvar data into sadb_address.
1955  * `buf' must has been allocated sufficiently.
1956  */
1957 static caddr_t
1958 pfkey_setsadbsa(buf, lim, spi, wsize, auth, enc, flags)
1959         caddr_t buf;
1960         caddr_t lim;
1961         u_int32_t spi, flags;
1962         u_int wsize, auth, enc;
1963 {
1964         struct sadb_sa *p;
1965         u_int len;
1966
1967         p = (struct sadb_sa *)buf;
1968         len = sizeof(struct sadb_sa);
1969
1970         if (buf + len > lim)
1971                 return NULL;
1972
1973         memset(p, 0, len);
1974         p->sadb_sa_len = PFKEY_UNIT64(len);
1975         p->sadb_sa_exttype = SADB_EXT_SA;
1976         p->sadb_sa_spi = spi;
1977         p->sadb_sa_replay = wsize;
1978         p->sadb_sa_state = SADB_SASTATE_LARVAL;
1979         p->sadb_sa_auth = auth;
1980         p->sadb_sa_encrypt = enc;
1981         p->sadb_sa_flags = flags;
1982
1983         return(buf + len);
1984 }
1985
1986 /*
1987  * set data into sadb_address.
1988  * `buf' must has been allocated sufficiently.
1989  * prefixlen is in bits.
1990  */
1991 static caddr_t
1992 pfkey_setsadbaddr(buf, lim, exttype, saddr, prefixlen, ul_proto)
1993         caddr_t buf;
1994         caddr_t lim;
1995         u_int exttype;
1996         struct sockaddr *saddr;
1997         u_int prefixlen;
1998         u_int ul_proto;
1999 {
2000         struct sadb_address *p;
2001         u_int len;
2002
2003         p = (struct sadb_address *)buf;
2004         len = sizeof(struct sadb_address) + PFKEY_ALIGN8(saddr->sa_len);
2005
2006         if (buf + len > lim)
2007                 return NULL;
2008
2009         memset(p, 0, len);
2010         p->sadb_address_len = PFKEY_UNIT64(len);
2011         p->sadb_address_exttype = exttype & 0xffff;
2012         p->sadb_address_proto = ul_proto & 0xff;
2013         p->sadb_address_prefixlen = prefixlen;
2014         p->sadb_address_reserved = 0;
2015
2016         memcpy(p + 1, saddr, saddr->sa_len);
2017
2018         return(buf + len);
2019 }
2020
2021 /*
2022  * set sadb_key structure after clearing buffer with zero.
2023  * OUT: the pointer of buf + len.
2024  */
2025 static caddr_t
2026 pfkey_setsadbkey(buf, lim, type, key, keylen)
2027         caddr_t buf;
2028         caddr_t lim;
2029         caddr_t key;
2030         u_int type, keylen;
2031 {
2032         struct sadb_key *p;
2033         u_int len;
2034
2035         p = (struct sadb_key *)buf;
2036         len = sizeof(struct sadb_key) + PFKEY_ALIGN8(keylen);
2037
2038         if (buf + len > lim)
2039                 return NULL;
2040
2041         memset(p, 0, len);
2042         p->sadb_key_len = PFKEY_UNIT64(len);
2043         p->sadb_key_exttype = type;
2044         p->sadb_key_bits = keylen << 3;
2045         p->sadb_key_reserved = 0;
2046
2047         memcpy(p + 1, key, keylen);
2048
2049         return buf + len;
2050 }
2051
2052 /*
2053  * set sadb_lifetime structure after clearing buffer with zero.
2054  * OUT: the pointer of buf + len.
2055  */
2056 static caddr_t
2057 pfkey_setsadblifetime(buf, lim, type, l_alloc, l_bytes, l_addtime, l_usetime)
2058         caddr_t buf;
2059         caddr_t lim;
2060         u_int type;
2061         u_int32_t l_alloc, l_bytes, l_addtime, l_usetime;
2062 {
2063         struct sadb_lifetime *p;
2064         u_int len;
2065
2066         p = (struct sadb_lifetime *)buf;
2067         len = sizeof(struct sadb_lifetime);
2068
2069         if (buf + len > lim)
2070                 return NULL;
2071
2072         memset(p, 0, len);
2073         p->sadb_lifetime_len = PFKEY_UNIT64(len);
2074         p->sadb_lifetime_exttype = type;
2075
2076         switch (type) {
2077         case SADB_EXT_LIFETIME_SOFT:
2078                 p->sadb_lifetime_allocations
2079                         = (l_alloc * soft_lifetime_allocations_rate) /100;
2080                 p->sadb_lifetime_bytes
2081                         = (l_bytes * soft_lifetime_bytes_rate) /100;
2082                 p->sadb_lifetime_addtime
2083                         = (l_addtime * soft_lifetime_addtime_rate) /100;
2084                 p->sadb_lifetime_usetime
2085                         = (l_usetime * soft_lifetime_usetime_rate) /100;
2086                 break;
2087         case SADB_EXT_LIFETIME_HARD:
2088                 p->sadb_lifetime_allocations = l_alloc;
2089                 p->sadb_lifetime_bytes = l_bytes;
2090                 p->sadb_lifetime_addtime = l_addtime;
2091                 p->sadb_lifetime_usetime = l_usetime;
2092                 break;
2093         }
2094
2095         return buf + len;
2096 }
2097
2098 /*
2099  * copy secasvar data into sadb_address.
2100  * `buf' must has been allocated sufficiently.
2101  */
2102 static caddr_t
2103 pfkey_setsadbxsa2(buf, lim, mode0, reqid)
2104         caddr_t buf;
2105         caddr_t lim;
2106         u_int32_t mode0;
2107         u_int32_t reqid;
2108 {
2109         struct sadb_x_sa2 *p;
2110         u_int8_t mode = mode0 & 0xff;
2111         u_int len;
2112
2113         p = (struct sadb_x_sa2 *)buf;
2114         len = sizeof(struct sadb_x_sa2);
2115
2116         if (buf + len > lim)
2117                 return NULL;
2118
2119         memset(p, 0, len);
2120         p->sadb_x_sa2_len = PFKEY_UNIT64(len);
2121         p->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
2122         p->sadb_x_sa2_mode = mode;
2123         p->sadb_x_sa2_reqid = reqid;
2124
2125         return(buf + len);
2126 }